Risk Impact/Probability Chart

Learning to Prioritize Risks

Risk management is an important function in organizations today. Companies undertake increasingly complex and ambitious projects, and those projects must be executed successfully, in an uncertain and often risky environment.

As a responsible manager, you need to be aware of these risks. Does this mean that you should try to address each and every risk that your project might face? Probably not – in all but the most critical environments, this can be much too expensive, both in time and resources.

Instead, you need to prioritize risks. If you do this effectively, you can focus the majority of your time and effort on the most important risks.

How to Use the Tool

The Risk Impact/Probability Chart is based on the principle that a risk has two primary dimensions:

Probability – A risk is an event that "may" occur. The probability of it occurring can range anywhere from just above 0 percent to just below 100 percent. (Note: It can't be exactly 100 percent, because then it would be a certainty, not a risk. And it can't be exactly 0 percent, or it wouldn't be a risk.)

Impact – A risk, by its very nature, always has a negative impact. However, the size of the impact varies in terms of cost and impact on health, human life, or some other critical factor.

The chart allows you to rate potential risks on these two dimensions. The probability that a risk will occur is represented on one axis of the chart – and the impact of the risk, if it occurs, on the other.

You use these two measures to plot the risk on the chart. This gives you a quick, clear view of the priority that you need to give to each. You can then decide what resources you will allocate to managing that particular risk.

The basic form of the Risk Impact/Probability Chart is shown in figure 1, below.

Figure 1 – The Risk Impact/Probability Chart

The corners of the chart have these characteristics:

Low impact/low probability – Risks in the bottom left corner are low level, and you can often ignore them.

Low impact/high probability – Risks in the top left corner are of moderate importance – if these things happen, you can cope with them and move on. However, you should try to reduce the likelihood that they'll occur.

High impact/low probability – Risks in the bottom right corner are of high importance if they do occur, but they're very unlikely to happen. For these, however, you should do what you can to reduce the impact they'll have if they do occur, and you should have contingency plans in place just in case they do.

High impact/high probability – Risks towards the top right corner are of critical importance. These are your top priorities, and are risks that you must pay close attention to.

Tip 1:

It's natural to want to turn this into a two-by-two matrix. The problem here is where the lines dividing the quadrants of the matrix lie. For example – should you ignore a 49 percent probability risk, which will cause a 49 percent of maximum loss? And why, in this example, should you pay maximum attention to a risk that has a 51 percent probability of occurring, with a loss of 51 percent of maximum loss?

Tip 2:

In some industries, you need to pay close attention to even very unlikely risks, where these risks involve injury or loss of human life, for example. Make sure you pay due attention to these risks.

To use the Risk Impact/Probability Chart, print this free worksheet, and then follow these steps:

List all of the likely risks that your project faces. Make the list as comprehensive as possible.

Assess the probability of each risk occurring, and assign it a rating. For example, you could use a scale of 1 to 10. Assign a score of 1 when a risk is extremely unlikely to occur, and use a score of 10 when the risk is extremely likely to occur.

Estimate the impact on the project if the risk occurs. Again, do this for each and every risk on your list. Using your 1-10 scale, assign it a 1 for little impact and a 10 for a huge, catastrophic impact.

Map out the ratings on the Risk Impact/Probability Chart.

Develop a response to each risk, according to its position in the chart. Remember, risks in the bottom left corner can often be ignored, while those in the top right corner need a great deal of time and attention. Read Risk Analysis and Risk Management for detailed strategies on developing a risk response plan.

With the Risk Impact/Probability Chart, you map out each risk – and its position determines its priority. High-probability/high-impact risks are the most critical, and you should put a great deal of effort into managing these. The low-probability/high-impact risks and high-probability/low-impact risks are next in priority, though you may want to adopt different strategies for each.

This site teaches you the skills you need for a happy and successful career; and this is just one of many tools and resources that you'll find here at Mind Tools. Subscribe to our free newsletter, or join the Mind Tools Club and really supercharge your career!

Comments (8)

PhillipS5428 wroteOver a month ago

HJB123
1. There doesn't have to be a correlation betweem probability and impact. The risk is affected by both and you are evaluating the risk.
2. Impact on anything. If the risk negatively effects the budget, yourself or your department's reputation, final result of project, etc. Risk of problems can effect a great deal of things.
3. The chances of it happening don't determine whether you should use the tool to evaluate the risk. If you find the risk is likeley going to happen, you used this tool to determine that.

This tool is used to help define the risks so you can properly plan on manageing them to make the poject you are working on the most effective.
"An ounce of prevention is worth a pound of cure"

Yolande wroteOver a month ago

Thanks for your comment JRoyals26.

JRoyals26 wroteOver a month ago

I agree with HJP's first point and tend to think about probability of a risk only after considering the internal controls.

Dianna wroteOver a month ago

Hi Icham,
I'm not sure there is any one person or organization credited with developing the Risk Impact/Probablity Chart. It appears to have evolved quite organically and stems from the philosophy that risk=probability*impact. I read in a couple sources on the web that it has been around since the 50s and 60s and originated in the the healthy and safety industry.

Is there a reason you are looking for the creator?

Dianna

lcham wroteOver a month ago

Does anyone know who the creator of this method of measuring risk was?

dp7622 wroteOver a month ago

I don't see the problem hjb. When you assess risk you assess it from a variety of perspectives therefore the direction of impact is expected to change. So the impact, regardless of impact on what or who, is important regardless, right? What am I missing?

And although I agree probability of risk and impact of risk are not related to one another in that they don't correlate negatively or positively, they are still dimensions important to risk prioritization. I want to be concentrating on risk that is highly probable and that is associated with a significant negative impact. If it's risky, the probability and impact have to be somewhere in the plot so knowing where on the plot seems inherently useful. Am I really being obtuse or what?

hjb123 wroteOver a month ago

Some problems with the Impact X Probability model.............

1. There is no logical relationship between Probability and Impact - each is important but not related.

2. Impact on what? One often hears of impact on the schedule, the cost etc. The schedule does not care, the cost does not care, the project does not care. Any impact only has meaning when related to a stakeholder in the project - to one person impact on cost is the most important thing to another it will be time, etc.

3. Any risk that is more than 50% probable is not a risk, by definition it is going to happen, so treat it as a part of the project plan and not part of the risk plan. If we removed all risk items that were more than 50% likely top happen away from the risk register and into the project plan then most risk registers would be pretty small

Lastly, has anyone noticed the direct relationship between the riskiness of a project and the time spent doing risk analysis? One way of increasing the riskiness exponentially is to devote even more time to defining the risks. Seriously though, if we applied more rigorous and meaningful formulae and effort to risk management we might get somewhere - we might start by checking how much we and our colleagues understand about probability - but we probably won't!

mayc wroteOver a month ago

That's a great way to conceptualize the idea of prioritizing risk. I've tended to do this in my head but I like the idea of graphing it. I can see it being really useful for communicating risk. Picture speaks a thousand words sort of thing. I think I might also use it as a tool my staff can provide to me to show the work they've done on project risk analysis.